A Low-Cost Approach to Crack Python CAPTCHAs Using AI-Based Chosen-Plaintext Attack
Source abstract
Abstract
CAPTCHA authentication has been challenged by recent technology advances in AI. However, many of the AI advances challenging CAPTCHA are either restricted by a limited amount of labeled CAPTCHA data or are constructed in an expensive or complicated way. In contrast, this paper illustrates a low-cost approach that takes advantage of the nature of open source libraries for an AI-based chosen-plaintext attack. The chosen-plaintext attack described here relies on a deep learning model created and trained on a simple personal computer in a low-cost way. It shows an efficient cracking rate over two open-source Python CAPTCHA Libraries, Claptcha and Captcha. This chosen-plaintext attack method has raised a potential security alert in the era of AI, particularly to small-business owners who use the open-source CAPTCHA libraries. The main contributions of this project include: (1) it is the first low-cost method based on chosen-plaintext attack by using the nature of open-source Python CAPTCHA libraries; (2) it is a novel way to combine TensorFlow object detection and our proposed peak segmentation algorithm with convolutional neural network to improve the recognition accuracy.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: User Authentication and Security Systems · Adversarial Robustness in Machine Learning · Advanced Malware Detection Techniques
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
Department of Computing Sciences, College at Brockport, State University of New York, Brockport, NY 14420, USA
References (34)
Show source-provided references
1. Chow, Y.W., Susilo, W., and Thorncharoensri, P. (2019). CAPTCHA Design and Security Issues. Advances in Cyber Security: Principles, Techniques, and Applications, Springer.10.1007/978-981-13-1483-4_4 ↗
2. Bursztein, E., Martin, M., and Mitchell, J. (2011, January 17–21). Text-based CAPTCHA Strengths and Weaknesses. Proceedings of the 18th ACM Conference on Computer and Communications Security, Chicago, IL, USA.10.1145/2046707.2046724 ↗
3. Saul, L.K., Weiss, Y., and Bottou, L. (2005). Using Machine Learning to Break Visual Human Interaction Proofs (HIPs). Advances in Neural Information Processing Systems 17, MIT Press.
4. Breaking CAPTCHAs with Convolutional Neural Networks
5. Selective Learning Confusion Class for Text-Based CAPTCHA Recognition10.1109/ACCESS.2019.2899044 ↗
6. Jaderberg, M., Vedaldi, A., and Zisserman, A. (2014, January 6–12). Deep Features for Text Spotting. Proceedings of the European Conference on Computer Vision, Zurich, Switzerland.10.1007/978-3-319-10593-2_34 ↗
7. Chen, J., Luo, X., Guo, Y., Zhang, Y., and Gong, D. (2017). A Survey on Breaking Technique of Text-Based CAPTCHA. Secur. Commun. Netw., 2017.10.1155/2017/6898617 ↗
8. An Attack on Hollow CAPTCHA Using Accurate Filling and Nonredundant Merging10.1080/02564602.2018.1520152 ↗
9. reCAPTCHA: Human-Based Character Recognition via Web Security Measures10.1126/science.1160379 ↗
10. Elson, J.E., Douceur, J.R., Howell, J., and Saul, J. (November, January 29). Asirra: A CAPTCHA that exploits interest-aligned manual image categorization. Proceedings of the ACM Conference on Computer and Communications Security, Alexandria, VA, USA.
11. Golle, P. (2008, January 27–31). Machine Learning Attacks Against the Asirra CAPTCHA. Proceedings of the 5th Symposium on Usable Privacy and Security, Alexandria, VA, USA.10.1145/1572532.1572585 ↗
12. Gradient-based learning applied to document recognition10.1109/5.726791 ↗
13. Ye, G., Tang, Z., Fang, D., Zhu, Z., Feng, Y., Xu, P., Chen, X., and Wang, Z. (2018, January 15–19). Yet Another Text Captcha Solver: A Generative Adversarial Network Based Approach. Proceedings of the ACM Conference on Computer and Communications Security, Toronto, ON, Canada.10.1145/3243734.3243754 ↗
14. Von Ahn, L., Blum, M., Hopper, N.J., and Langford, J. (2003, January 4–8). CAPTCHA: Using hard AI problems for security. Proceedings of the International Conference on the Theory and Applications of Cryptographic Techniques, Warsaw, Poland.10.1007/3-540-39200-9_18 ↗
15. Yan, J., and El Ahmad, A.S. (2008, January 27–31). A Low-cost Attack on a Microsoft CAPTCHA. Proceedings of the 15th ACM Conference on Computer and Communications Security, Alexandria, VA, USA.10.1145/1455770.1455839 ↗
16. Gao, H., Yan, J., Cao, F., Zhang, Z., Lei, L., Tang, M., Zhang, P., Zhou, X., Wang, X., and Li, J. (2016, January 21–24). A Simple Generic Attack on Text Captchas. Proceedings of the Network and Distributed System Security Symposium 2016, San Diego, CA, USA.10.14722/ndss.2016.23154 ↗
17. Bursztein, E., Aigrain, J., Moscicki, A., and Mitchell, J.C. (2014, January 19). The End is Nigh: Generic Solving of Text-based CAPTCHAs. Proceedings of the 8th USENIX Workshop on Offensive Technologies (WOOT 14), San Diego, CA, USA.
18. Stark, F., Hazırbaş, C., Triebel, R., and Cremers, D. CAPTCHA Recognition with Active Deep Learning. Proceedings of the German Conference on Pattern Recognition Workshop, Available online: https://www.techfak.uni-bielefeld.de/~fschleif/mlr/mlr_03_2015.pdf.
19. Sivakorn, S., Polakis, I., and Keromytis, A.D. (2016, January 21–24). I am Robot: (Deep) Learning to Break Semantic Image CAPTCHAs. Proceedings of the 2016 IEEE European Symposium on Security and Privacy (EuroS P), Saarbrucken, Germany.10.1109/EuroSP.2016.37 ↗
20. Recognition of CAPTCHA Characters by Supervised Machine Learning Algorithms10.1016/j.ifacol.2018.07.155 ↗
21. Jia, Y., Shelhamer, E., Donahue, J., Karayev, S., Long, J., Girshick, R.B., Guadarrama, S., and Darrell, T. (2014, January 3–7). Caffe: Convolutional Architecture for Fast Feature Embedding. Proceedings of the 22nd ACM international conference on Multimedia, Orlando, FL, USA.10.1145/2647868.2654889 ↗
22. Gao, H., Wang, W., Qi, J., Wang, X., Liu, X., and Yan, J. (2013, January 4–8). The Robustness of Hollow CAPTCHAs. Proceedings of the 2013 ACM SIGSAC Conference on Computer & Communications Security, Berlin, Germany.10.1145/2508859.2516732 ↗
23. Ye, Q., Chen, Y., and Zhu, B. (2014, January 7–10). The Robustness of a New 3D CAPTCHA. Proceedings of the 2014 11th IAPR International Workshop on Document Analysis Systems, Tours, France.10.1109/DAS.2014.31 ↗
24. An efficient segmentation algorithm for CAPTCHAs with line cluttering and character warping10.1007/s11042-009-0341-5 ↗
25. Rosenfeld, A., Zemel, R., and Tsotsos, J.K. (2018). The elephant in the room. arXiv.
26. Goodfellow, I., Bengio, Y., and Courville, A. (2016). Deep Learning, MIT Press.
27. Friedman, J., Hastie, T., and Tibshirani, R. (2001). The Elements of Statistical Learning, Springer.10.1007/978-0-387-21606-5 ↗
28. CAPTCHA and its Alternatives: A Review10.1002/sec.1157 ↗
29. Lin, R., Huang, S.Y., Bell, G.B., and Lee, Y.K. (2011, January 17–20). A new CAPTCHA interface design for mobile devices. Proceedings of the Twelfth Australasian User Interface Conference, Perth, Australia.
30. Game-based image semantic CAPTCHA on handset devices10.1007/s11042-013-1666-7 ↗
31. A computer vision attack on the ARTiFACIAL CAPTCHA10.1007/s11042-013-1823-z ↗
32. On the security and usability of dynamic cognitive game CAPTCHAs10.3233/JCS-16847 ↗
33. Nguyen, V.D., Chow, Y.W., and Susilo, W. (2012, January 20–22). Attacking animated CAPTCHAs via character extraction. Proceedings of the International Conference on Cryptology and Network Security, Paraty, Brazil.10.1007/978-3-642-35404-5_9 ↗
34. Bock, K., Patel, D., Hughey, G., and Levin, D. (2017, January 14–15). unCaptcha: A low-resource defeat of recaptcha’s audio challenge. Proceedings of the 11th USENIX Workshop on Offensive Technologies (WOOT 17), Vancouver, BC, Canada.